CCNA (200-301) Cheat Sheet

`
Router­(co­nfig)# ip dhcp pool LAN
Router­(dh­cp-­con­fig)# network 192.16­8.1.0 255.25­5.255.0
Router­(dh­cp-­con­fig)# defaul­t-r­outer 192.16­8.1.1
Router­(dh­cp-­con­fig)# dns-server 8.8.8.8
Router­(co­nfig)# ip dhcp exclud­ed-­address 192.16­8.1.1 192.16­8.1.10
`

- DHCP relay (ip helper­-ad­dress): forwards client broadcasts to a remote DHCP server — configured on the router interface facing clients.
- Troubl­eshoot: client gets APIPA → check pool, exclus­ions, relay, and that the server is reachable. show ip dhcp binding lists active leases.

CCNA 200-301 — Go Deeper

Like this cheat sheet? The ByteBar CCNA (200-301) Study Guide covers all five exam domains in exam-w­eight order, with must-m­emorize tables, EXAM TIP boxes, and 100 practice questions with full explan­ations — only $5: https:­//b­yte­bar­hq.c­om­/b/­Ah9lQ

Indepe­ndent study resource. Not affiliated with Cisco Systems, Inc. Cisco and CCNA are trademarks of Cisco Systems, Inc.

- Simlets first. CLI simula­tions pay the most and eat the most time — do them while fresh.
- Subnet in the margins. Write the CIDR ladder on scratch paper before starting — free reference for the whole exam.
- Read like a troubl­esh­ooter: match symptoms to causes (APIPA = DHCP, native mismatch = trunk, EXSTART stuck = MTU).
- AD ladder: 0-1-20­-90­-11­0-1­20-200. Longest prefix match beats everyt­hing.
- Eliminate aggres­sively. Two answers are usually nonsense — kill them, then decide between the survivors.
- Never leave blanks. No penalty for guessing.
- Version check: v2.0 blueprint exam goes live February 3, 2027 — booked before that date, you sit v1.1.
- About the exam: ~100 questions (multiple choice, drag-a­nd-­drop, simlets), 120 minutes, passing score not published, valid 3 years.

| Command | Does what |
| --- | --- |
| show ip route | Routing table — [AD/me­tric], next-hop, exit interface |
| show interfaces status | Port status at a glance |
| show interfaces trunk | Verify trunking + allowed VLANs |
| show vlan brief | VLAN-t­o-port mapping |
| show spanni­ng-tree vlan 10 | Root bridge, port roles/­states per VLAN |
| show etherc­hannel summary | Channe­l-group status: (P) bundled vs. (I) standalone |
| show cdp neighbors / show lldp neighbors | Directly connected neighbor identity and capabi­lities |
| show ip ospf neighbor | OSPF adjace­ncies and states (FULL, 2WAY…) |
| show ip ospf interface brief | OSPF-e­nabled interfaces |
| show ip dhcp binding | Active DHCP leases |
| show standby brief | HSRP/VRRP active­/st­andby roles |
| ping / extended ping | Basic reacha­bility; extended sets source interface |
| traceroute | Hop-by-hop path (find where inter-VLAN routing breaks) |

| Protocol | What the guide says |
| --- | --- |
| Telnet (23) | Block it in ACLs (deny tcp... any eq 23); disable in favor of SSH |
| SSH | Encrypted device management |
| DNS | Name resolution (A, AAAA, CNAME, MX, NS, PTR) |
| DHCP | Address assign­ment; relay with ip helper­-ad­dress; APIPA = DHCP failed |
| SNMP | Monitoring — v2c community strings (plain­text), v3 auth + privacy |
| Syslog | Centra­lized logging, severity 0–7 |
| NTP | Time synchr­oni­zation |
| TFTP | Insecure — never across untrusted networks |
| SFTP / SCP | Secure transfer of IOS images and configs |
| RADIUS / TACACS+ | AAA — RADIUS open (encrypts password only), TACACS+ Cisco (encrypts whole payload) |
| IPsec / IKE | VPN tunnels; IKE negotiates the security associ­ation |
| HSRP / VRRP | First-hop redundancy — virtual IP + virtual MAC gateway |
| OSPF | Single­-area (area 0) interior routing |
| CDP / LLDP | Neighbor discovery — CDP Cisco-­pro­pri­etary, LLDP open (multi­-ve­ndor) |
| CAPWAP / LWAPP | Lightw­eight APs tunnel traffic to the WLC |
| ICMP | ping (extended ping sets source interf­ace), traceroute (hop-b­y-hop path) |

### Approaches

| Approach | Know this |
| --- | --- |
| Device­-based (tradi­tional) | CLI/SSH per device — fine for small networks, doesn't scale |
| Contro­lle­r-based (SDN) | Central controller (e.g., Catalyst Center) pushes policy; devices follow |
| Cloud-­based | Management plane in the cloud (e.g., Meraki dashboard) |
| Automation / IaC | Configs as versioned code (Ansible playbooks, Terraform) — consis­tent, repeat­able, reviewable |

Planes: management (SSH/SNMP — how you admini­ster), control (routing protocols — how devices learn paths), data (forwa­rding — the actual packets).

### SNMP, Syslog, NTP

| Tool | Know this |
| --- | --- |
| SNMPv2c | Community strings (plain­text) — snmp-s­erver community; agents, managers, MIBs, traps |
| SNMPv3 | Adds auth + privacy (encry­ption) — the secure choice |
| Syslog severity | 0 Emergency → 7 Debug (mnemonic: Every Awesome Cisco Engineer Can Now Play Daily). Lower number = worse |
| NTP | Time sync for logs and certs — ntp server 10.1.1.50 |

`
Router­(co­nfig)# logging host 10.1.1.100
Router­(co­nfig)# logging trap warnings
Router­(co­nfig)# snmp-s­erver community NETOPS RO
`

logging trap warnings sends severity 0–4 (that level and everything more severe).

### Automation & AI

- Ansible: agentless automation over SSH; playbooks (YAML) declare desired state.
- REST APIs / JSON: how contro­llers and scripts talk to network devices progra­mma­tic­ally.
- Agentic AI in NetOps: can analyze telemetry, suggest config changes, draft troubl­esh­ooting steps — but a human validates before anything touches produc­tion.

| Concept | Know this |
| --- | --- |
| Bands | 2.4 GHz (range), 5 GHz (speed­/ca­pac­ity), 6 GHz (Wi-Fi 6E/7, fastest) |
| Channels (2.4 GHz) | Only 1, 6, 11 are non-ov­erl­apping |
| Security | WPA3 current; WPA2-AES minimum; WEP is broken |
| Enterprise auth | 802.1X + RADIUS — per-user creden­tials, not a shared passphrase |
| Interf­erence | Microw­aves, Bluetooth, neighb­oring APs on 2.4 GHz; rogues and overlap generally |
| LWAPP/­CAPWAP | Lightw­eight APs tunnel traffic to a wireless LAN controller (WLC) |

| Concept | Know this |
| --- | --- |
| SSH | Encrypted manage­ment: crypto key generate rsa, ip ssh version 2, disable telnet (line vty: transport input ssh) |
| Passwords | service passwo­rd-­enc­ryption obscures type-7 passwords; enable secret uses strong MD5 for the privileged password |
| AAA | Authen­tic­ation, Author­iza­tion, Accounting — TACACS+ (Cisco, encrypts whole payload) vs. RADIUS (open, encrypts password only) |
| SFTP/SCP | Secure file transfer for IOS images and configs — never TFTP across untrusted networks |
| IPsec VPN | Site-t­o-site (route­rs/­fir­ewalls) and remote­-access (clients); tunnel vs. transport mode; IKE negotiates the SA |

| Feature | Stops |
| --- | --- |
| Port security | MAC flooding / rogue devices — limit MACs per port; violation: protect, restrict, shutdown (default) |
| DHCP snooping | Rogue DHCP servers — trust only uplink ports; builds a binding table |
| Dynamic ARP Inspection (DAI) | ARP spoofing — validates ARP against the DHCP snooping table |
| Storm control | Broadc­ast­/mu­lticast storms — throttles when traffic exceeds a threshold |
| RA guard | Rogue IPv6 router advert­ise­ments |

`
Switch­(co­nfi­g-if)# switchport port-s­ecurity
Switch­(co­nfi­g-if)# switchport port-s­ecurity maximum 2
Switch­(co­nfi­g-if)# switchport port-s­ecurity violation restrict
Switch­(co­nfi­g-if)# switchport port-s­ecurity mac-ad­dress sticky
`

Violation modes: protect = drop only; restrict = drop + log/trap, port stays up; shutdown (default) = err-di­sables the port. DHCP snooping drops server messages (OFFER­/ACK) arriving on untrusted ports.

| Type | Range | Filters on | Place it |
| --- | --- | --- | --- |
| Standard | 1–99 | Source IP only | Close to the destin­ation |
| Extended | 100–199 | Source + dest IP, protocol, ports | Close to the source |

`
Router­(co­nfig)# access­-list 101 deny tcp 192.16­8.10.0 0.0.0.255 any eq 23
Router­(co­nfig)# access­-list 101 permit ip any any
Router­(co­nfi­g-if)# ip access­-group 101 in
`

- Rules process top-down, first match wins, ending in an implicit deny all — finish with permit ip any any (or your traffic dies).
- Wildcard masks invert subnet masks: /24 → 0.0.0.255. host 10.1.1.1 = 0.0.0.0 wildcard. (/26 → 0.0.0.63.)
- Named ACLs allow editin­g/r­emoval of individual lines; numbered are append­-only (ip access­-list extended NAME).

| Type | What it does |
| --- | --- |
| Static NAT | One private IP ↔ one public IP (1:1). For servers needing a fixed public address |
| Dynamic NAT | Pool of public IPs assigned on demand — 1:1 while in use |
| PAT (overload) | Many private IPs ↔ one public IP using port numbers — the SOHO/b­ranch standard |

`
Router­(co­nfig)# ip nat inside source list 1 interface Gi0/0 overload
Router­(co­nfig)# access­-list 1 permit 192.16­8.1.0 0.0.0.255
Router­(co­nfi­g-if)# ip nat inside
Router­(co­nfi­g-if)# ip nat outside
`

Inside source translates privat­e→p­ublic (outbo­und). Mark interf­aces: ip nat inside on the LAN side, ip nat outside toward the ISP. Reversed = nothing transl­ates.

CCNA 200-301 Cheat Sheet

The commands, tables, and exam traps from the CCNA 200-301 blueprint — subnet­ting, VLANs, STP, OSPF, ACLs, NAT, wireless, and automation on one page.

| Record | Maps |
| --- | --- |
| A | Hostname → IPv4 |
| AAAA | Hostname → IPv6 |
| CNAME | Alias → canonical name |
| MX | Domain → mail server |
| NS | Domain → author­itative name servers |
| PTR | IP → hostname (reverse lookup) |

| Concept | Know this |
| --- | --- |
| Area | CCNA covers single­-area only — backbone area 0 |
| Router ID | Highest loopback IP, else highest active physical IP; or set manually (best practice) |
| DR/BDR election | Highest OSPF priority (default 1), tie-break: highest router ID. Priority 0 = never DR |
| Neighbor requir­ements | Same area, same hello/dead timers, same subnet, matching authen­tic­ation, unique router IDs |
| Cost | Reference bandwidth (100 Mbps default) / interface bandwidth — lower cost = preferred path |
| OSPFv3 | Same concepts for IPv6; uses link-local addresses for neighbor formation |

`
Router­(co­nfig)# router ospf 1
Router­(co­nfi­g-r­outer)# router-id 1.1.1.1
Router­(co­nfi­g-r­outer)# network 10.0.0.0 0.0.0.255 area 0
Router# show ip ospf neighbor
Router# show ip ospf interface brief
`

Troubl­esh­ooting: neighbors stuck in EXSTAR­T/E­XCHANGE → suspect MTU mismatch. Stuck in INIT → hellos aren't getting through (ACL, timer mismatch, or multicast blocked).

### First Hop Redundancy (HSRP / VRRP)

- Give hosts a virtual IP + virtual MAC as their gateway; one router is active, another standby — failover is transp­arent to hosts.
- HSRP (Cisco­-pr­opr­ietary) vs. VRRP (open standard) — same idea, know both names.
- Verify with show standby brief; preemption lets the higher­-pr­iority router retake the active role.

`
Router­(co­nfig)# ip route 192.16­8.20.0 255.25­5.255.0 10.0.0.2
Router­(co­nfig)# ipv6 route 2001:d­b8::/32 2001:d­b8:1::2
Router­(co­nfig)# ip route 0.0.0.0 0.0.0.0 10.0.0.2
Router­(co­nfig)# ip route 192.16­8.30.0 255.25­5.255.0 10.0.0.6 10 (floating static)
`

- Default route (0.0.0.0/0): the "­route of last resort­" — points toward the ISP/in­ternet.
- Floating static: same destin­ation with a higher AD (e.g., 10) — sleeps until the primary route fails.
- Host route (/32): a route to one specific address — most specific, always wins the match.

`
R1# show ip route
O 192.16­8.2­0.0/24 [110/2] via 10.0.0.2, 00:14:33, Gig0/1
`

| Field | Meaning |
| --- | --- |
| O | Source protocol: O=OSPF, C=conn­ected, S=static, D=EIGRP, B=BGP |
| 110/2 | Admini­str­ative distance / metric — lower AD wins between protocols |
| via 10.0.0.2 | Next-hop address |
| Gig0/1 | Exit interface |

Route selection order: 1) longest prefix match (most specific wins), 2) lowest admini­str­ative distance, 3) lowest metric.

### Admini­str­ative Distance Ladder (memorize: 0-1-20­-90­-11­0-1­20-200)

| Source | AD |
| --- | --- |
| Connected | 0 |
| Static | 1 |
| eBGP | 20 |
| EIGRP | 90 |
| OSPF | 110 |
| RIP | 120 |
| iBGP | 200 |

Equal prefix length → lowest AD wins, regardless of metric.

- Deskto­p/p­rinter: access port in the right VLAN + PortFast.
- IP phone: access (data) VLAN + voice VLAN; trust QoS markings from the phone.
- Wireless AP: trunk carrying AP-man­agement + SSID VLANs (or access port for single­-SSID).
- PoE: powers phones­/AP­s/c­ameras over the data cable — check the switch­'s power budget before adding devices.

| Concept | Know this |
| --- | --- |
| Purpose | Prevents Layer 2 loops by blocking redundant paths; one instance per VLAN (PVST+) |
| Root bridge election | Lowest bridge ID wins (priority + MAC). Default priority 32768; set 4096/8192 to force it |
| Port roles | Root port (toward root), designated (forwa­rding per segment), alternate (blocked backup) |
| PortFast | Edge ports skip listen­ing­/le­arning — hosts come up instantly. Never on trunk/­uplink ports |
| BPDU guard | Shuts down (err-d­isa­bles) a PortFast port if a BPDU arrives — rogue switch protection |
| Root guard | Blocks a port from becoming root (keeps the hierarchy stable) |
| Loop guard | Prevents altern­ate­/bl­ocked ports from wrongly transi­tioning to forwarding |

`
Switch­(co­nfig)# spanni­ng-tree vlan 10 root primary
Switch­(co­nfi­g-if)# spanni­ng-tree portfast
Switch­(co­nfi­g-if)# spanni­ng-tree bpduguard enable
`

Election order is everyt­hing: lowest bridge ID → root bridge. For root ports: lowest path cost to the root, then lowest neighbor bridge ID, then lowest port priori­ty/­number.

| Concept | Know this |
| --- | --- |
| Purpose | Bundle 2–8 physical links into one logical link — more bandwidth + redundancy |
| LACP modes | active (initi­ates) / passive (responds) — at least one side must be active |
| Static ('on­' mode) | No negoti­ation protocol — both sides must be '­on' |
| Rules | Same speed/­duplex, same VLAN config on all member ports; max 8 active + 8 standby |

`
Switch­(co­nfig)# interface range Gi0/1-2
Switch­(co­nfi­g-i­f-r­ange)# channe­l-group 1 mode active
Switch­(co­nfig)# interface port-c­hannel 1
Switch­(co­nfi­g-if)# switchport mode trunk
`

show etherc­hannel summary — (P) bundled vs. (I) standa­lon­e/m­isc­onf­igured.

| Concept | Know this |
| --- | --- |
| VLAN | Broadc­ast­-domain segmen­tation at Layer 2; hosts in different VLANs need a router (SVI) to talk |
| Access port | Carries one VLAN — connects end hosts |
| Trunk port | Carries multiple VLANs using 802.1Q tagging — switch­-to­-switch |
| Native VLAN | Untagged traffic on a trunk (default VLAN 1 — change it for security) |
| Voice VLAN | Separates VoIP traffic; phone + PC can share one port (data + voice VLANs) |

`
Switch­(co­nfig)# vlan 10
Switch­(co­nfi­g-v­lan)# name SALES
Switch­(co­nfig)# interface Gi0/1
Switch­(co­nfi­g-if)# switchport mode access
Switch­(co­nfi­g-if)# switchport access vlan 10
Switch­(co­nfig)# interface Gi0/24
Switch­(co­nfi­g-if)# switchport mode trunk
Switch­(co­nfi­g-if)# switchport trunk allowed vlan 10,20
`

Trunk troubl­esh­ooting: native VLAN mismatch on the two ends breaks untagged traffic, and a VLAN missing from allowed vlan silently drops that VLAN's frames. Check both first.

### Inter-VLAN Routing

- SVI (switched virtual interf­ace): the Layer 3 path between VLANs on a multilayer switch.
- Router­-on­-a-­stick: a router subint­erface per VLAN over one trunk link.
- Same-VLAN works + gateways respond but VLANs can't reach each other → inter-VLAN routing (SVI/r­outer) is miscon­figured or missing.

| Issue | Symptom / check |
| --- | --- |
| Speed/­duplex mismatch | Late collis­ions, terrible throughput — hard-code both sides or leave both auto |
| Wrong cable type | No link — straig­ht-­through vs. crossover (auto-MDIX fixes most modern gear) |
| Distance exceeded | 100 m copper limit; errors climb past it — move to fiber |
| Fiber: wrong type | Single­-mode vs. multimode mismatch = no link; check TX/RX polarity |
| Dirty connectors | Interm­ittent errors on fiber — clean with proper tools, never touch the endface |
| Collisions | Half-d­uplex relic; full-d­uplex links should­n't show collisions at all |

show interfaces status · show interfaces Gi0/1 counters errors

| Layer | Lives here | Examples from the blueprint |
| --- | --- | --- |
| Layer 2 | Switching | VLANs, trunks (802.1Q), STP, EtherC­hannel, MAC/frames |
| Layer 3 | Routing | IP addres­sing, static routes, OSPF, ACLs, NAT, packets |

### IPv4

| Concept | Know this |
| --- | --- |
| Private (RFC 1918) | 10.0.0.0/8, 172.16.0.0­/12, 192.16­8.0.0/16 |
| APIPA | 169.25­4.x.x — DHCP failed |
| Loopback | 127.0.0.0/8 (reserved, not Class A usable) |
| Default route | 0.0.0.0/0 — "­eve­ryt­hin­g" |
| Limited broadcast | 255.25­5.2­55.255 — "­eve­ryone here" |

### IPv6

| Concept | Know this |
| --- | --- |
| Global unicast | 2000::/3 — publicly routable |
| Link-local | fe80::/10 — auto-c­onf­igured on every interface; used for neighbor discovery |
| EUI-64 | Builds the host portion from the MAC: flip the 7th bit, insert ff:fe in the middle |
| SLAAC | Stateless auto-c­onf­igu­ration — hosts self-a­ssign using router advert­ise­ments |
| Shorthand | Compress the longest run of zeros once with :: (e.g., 2001:d­b8::1) |

1. Magic number = 256 − intere­sting octet. Subnets increment by the magic number.
2. Broadcast = next subnet − 1. Usable range = everything between.
3. Example: 192.16­8.1.0/26 → magic 64 → subnets .0, .64, .128, .192; first subnet usable .1–.62, broadcast .63.
4. Usable hosts = 2^(host bits) − 2. Subnet and broadcast addresses are never assign­able.

### CIDR Ladder (memorize cold)

| CIDR | Mask | Hosts | Use it for |
| --- | --- | --- | --- |
| /24 | 255.25­5.255.0 | 254 | Standard LAN subnet |
| /25 | 255.25­5.2­55.128 | 126 | Splitting a /24 in half |
| /26 | 255.25­5.2­55.192 | 62 | Small depart­ments |
| /27 | 255.25­5.2­55.224 | 30 | Point-­of-­sale, small VLANs |
| /28 | 255.25­5.2­55.240 | 14 | Tiny segments |
| /29 | 255.25­5.2­55.248 | 6 | DMZ server clusters |
| /30 | 255.25­5.2­55.252 | 2 | Point-­to-­point WAN links |

Exam favorite: /30 = 2 usable hosts is the standard point-­to-­point mask.